Week 10, 2019
4–10 March 2019
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2019-0604 A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microso…EPSS 100%
Microsoft · Microsoft SharePoint Server · Microsoft SharePoint Enterprise Server · Microsoft SharePoint Foundation
- Critical 9.9 EPSS 97%
-
Critical 9.9
CVE-2018-18809 TIBCO JasperReports Library Directory Traversal VulnerabilityEPSS 79%
TIBCO Software · TIBCO JasperReports Server · TIBCO JasperReports Server for ActiveMatrix BPM · TIBCO JasperReports Server - Community Edition
- Critical 9.8 EPSS 78%
- Critical 9.9 EPSS 74%
- Critical 9.9 EPSS 3.5%
-
Critical 10.0
CVE-2018-18815 TIBCO JasperReports Server User Information DisclosureEPSS 3.1%
TIBCO Software · TIBCO JasperReports Server · TIBCO JasperReports Server for ActiveMatrix BPM · TIBCO JasperReports Server - Community Edition
- Critical 9.9 EPSS 3%
- Critical 9.8 EPSS 2.6%
- Critical 9.9 EPSS 2.4%
- Critical 9.8 EPSS 2.3%
- Critical 9.1 EPSS 1.4%
- Critical 9.0
- Critical 9.0
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2019-0626 A memory corruption vulnerability exists in the Windows Server DHCP service when an attacker sends specially crafted packets to a DHCP server, aka 'Windows DHC…EPSS 69%
-
Unscored
CVE-2019-0618 A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code E…EPSS 67%
-
Unscored
CVE-2019-9632 ESAFENET CDG V3 and V5 has an arbitrary file download vulnerability via the fileName parameter in download.jsp because the InstallationPack parameter is mishan…EPSS 39%
-
Unscored
CVE-2019-6225 A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12.1.2. A malicious application…EPSS 29%
-
Unscored
CVE-2019-0728 A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project, aka 'Visual Studio Code Remot…EPSS 28%
-
Unscored
CVE-2019-0724 An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'. This CVE ID …EPSS 24%
Microsoft · Microsoft Exchange Server 2019 · Microsoft Exchange Server 2016 · Microsoft Exchange Server 2013
-
Unscored
CVE-2019-9624 Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the "Java file manager" and "Upload and Download" privileges to upload a crafted .…EPSS 24%
-
Unscored
CVE-2019-0599 A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Ex…EPSS 20%
Advisories
- SUSE / openSUSE Security Updates 12
- Amazon Linux Security Center (ALAS) 101 critical
- Debian Security (DSA / DLA) 91 critical
- Ubuntu Security Notices (USN) 6
- BSI CERT-Bund (WID) 5
- CERT@VDE 21 critical
- CISA ICS & IT advisories 11 critical
- Oracle Linux Security Advisories (ELSA) 1
- DLA-1703-1 jackson-databind - security update 10 CVEs
- ALAS2-2019-1168 Critical: thunderbird security update (Amazon Linux 2) 6 CVEs
- VDE-2019-003 PHOENIX CONTACT: Multiple Vulnerabilities in MEVIEW3 3 CVEs
- ICSA-19-064-01 Rockwell Automation RSLinx Classic 1 CVEs